Privacy Policy

Information we collect

• Account and workspace information: your Google account email and name, agency name, branding, client names, site addresses, settings, and saved work.
• Search Console data: the properties your account can access and, for sites you add, search queries, pages, clicks, impressions, average positions, and URL inspection results. We store this information to build trends, prioritize fixes, and generate reports.
• Google authorization: access credentials that let the service refresh data after you sign in. Stored Google refresh tokens are encrypted.
• Optional Business Profile data: if you connect this feature, account and location details, search keywords, and performance measures such as calls, directions, and website clicks.
• Optional leads and revenue: information you import or send through a webhook, such as dates, event identifiers, landing pages, sources, call duration, deal status, and amounts. Lead contact details used for matching are converted to salted hashes; a short phone-number hint may be retained.
• Public website and technical information: page titles, text, metadata, public search results, request information processed by our hosting infrastructure, and diagnostic records used to run the service.

Google permissions and how we use them

Google sign-in requests your basic profile and email, plus read-only Search Console access. We use that access to show your properties, sync search performance, inspect indexing status, and prepare the dashboard, fix list, and client reports. We do not request access to Gmail, Drive, or your Google Ads account.

Business Profile is a separate, optional connection. Google labels its permission as Business Profile management access. RankUpside uses that connection to read location and performance data; the current integration does not edit your listing.

Our handling of Google API data follows the Google API Services User Data Policy, including its Limited Use requirements. Google data is used for the features you connect, not sold to data brokers, used to target advertising, or used to train general-purpose AI models. Human access is limited to your authorized support requests, necessary security work, or legal obligations.

When information is shared

Vercel hosts the application and Supabase provides its database. These services process information needed to operate RankUpside. Google processes requests made to its APIs. Market-data features use treg and DataForSEO; requests can include a client domain, location, language, and keywords selected from Search Console. Those requests do not include your Google refresh token or imported lead contact details.

You control report sharing. Anyone with a client's report link can view that report. You can replace the link to disable the previous one.

Claude Code and other agents receive a client's fix list and supporting evidence only when you give them an agent key or paste a copied prompt. Keys are read-only and limited to one client. You can revoke them in client settings. Data you send to an external AI service is also handled under that service's terms and privacy policy.

Information may also be disclosed when required by law or necessary to investigate abuse or protect the service. We do not sell your personal information.

Storage, security, and retention

The service uses HTTPS, encrypted stored Google refresh tokens, hashed agent keys, and workspace access checks. Saved client data supports historical comparisons and reports. Successful Search Console syncs trim weekly search history older than approximately 70 weeks; pausing a site does not delete its saved data.

You can remove a client in the app to delete its associated client records from the active database. Revoking Google access stops future authorized access but does not itself delete previously imported data. Account records, stored connections, and operational records are separate from client-site removal. Contact us to request deletion of your workspace and stored Google credentials, or to ask about retained records and provider backups.

Cookies and browser storage

We use cookies for your signed-in session, Google sign-in security checks, temporary status messages, and theme, sidebar or welcome guide preferences. Session cookies last up to 30 days; interface preferences can last up to one year. The current website does not include advertising trackers or a third-party marketing analytics script.

If you install our optional attribution snippet on a client website, it stores a landing page and traffic source in that visitor's local browser storage and uses them for up to 90 days. It adds attribution fields to forms; the snippet itself does not send form contents to RankUpside. The website operator is responsible for the notices and consent needed for that installation.

Your choices and requests

You can pause syncing, remove client sites, replace report links, and revoke agent keys in the app. You can remove Google access through your Google Account connections.

For access, correction, export, or deletion requests, email hello@rankupside.com from the account associated with your workspace and describe the request. If your information was provided by an agency using RankUpside, identify that agency so the request can be directed to the appropriate workspace.

Changes and contact

RankUpside is a business service for agencies and site owners, not a service directed at children. Updates to this policy will appear here with a new date. A new use of Google data outside the permissions and purposes you authorized requires an updated disclosure and consent before that use begins.

Contact Verlua at hello@rankupside.com. See also our Terms of Service.